[PATCH v5 0/3] x86/tdx: Fix port I/O handling bugs
From: Kiryl Shutsemau
Date: Wed Jul 01 2026 - 07:15:01 EST
From: "Kiryl Shutsemau (Meta)" <kas@xxxxxxxxxx>
Three fixes for emulated port I/O in the TDX guest #VE handler.
Patch 1 fixes an off-by-one in the GENMASK() used by handle_in() and
handle_out(): the mask was one bit too wide for every I/O size.
Patch 3 fixes 32-bit port IN to zero-extend into RAX, per x86
semantics, instead of preserving the upper 32 bits. To avoid
open-coding the partial-register-write rules, patch 2 first lifts KVM's
assign_register() helper into <asm/insn-eval.h> as insn_assign_reg() so
both KVM and the #VE handler can share it.
Patch 2 touches arch/x86/kvm/emulate.c (it removes assign_register() and
routes the callers through the new helper), so an ack from the KVM
maintainers would be appreciated before this goes through the x86 tree.
Changes since v4:
- Rebase onto v7.2-rc1.
- insn_assign_reg(): drop the arithmetic read-modify-write body from
v4 and lift KVM's assign_register() verbatim (typed-pointer writes).
This fixes the unaligned access / adjacent-register clobber for
high-byte registers (AH/CH/DH/BH) that Sashiko flagged on v4, where
the emulator hands the helper a pointer offset by one byte. Update
the changelog to match.
- Cc: stable on the insn_assign_reg() patch, as it is a prerequisite
for the patch 3 fix.
- Collect Reviewed-by from Binbin Wu and Rick Edgecombe.
v4: https://lore.kernel.org/all/cover.1780584300.git.kas@xxxxxxxxxx/
Kiryl Shutsemau (Meta) (3):
x86/tdx: Fix off-by-one in port I/O handling
x86/insn-eval: Add insn_assign_reg() helper
x86/tdx: Fix zero-extension for 32-bit port I/O
arch/x86/coco/tdx/tdx.c | 10 ++++------
arch/x86/include/asm/insn-eval.h | 30 ++++++++++++++++++++++++++++++
arch/x86/kvm/emulate.c | 26 ++++----------------------
3 files changed, 38 insertions(+), 28 deletions(-)
base-commit: dc59e4fea9d83f03bad6bddf3fa2e52491777482
--
2.54.0